Salt Lake City, May 5, 2026, 10:22 MDT
Utah’s new online age-verification law takes effect Wednesday, making the state the first in the U.S. to expressly pull VPN use into enforcement of adult-site age checks. The measure does not ban VPNs, but it makes covered websites responsible for Utah users even when they mask where they are.
That matters now because the fight has moved from whether adult sites must check ages to whether they can be forced to police hidden location. A VPN, or virtual private network, routes traffic through another server so a user’s internet address and apparent location can change; Utah’s statute says a person physically in Utah still counts as a Utah visitor.
The law applies to commercial websites that knowingly publish or distribute a “substantial portion” of material harmful to minors, defined in the statute as more than one-third of a site’s total material. In plain English, the provision is aimed at adult-content sites and similar services, not general websites.
The sharpest section says covered sites may not facilitate or encourage use of a VPN or proxy server to get around age verification, including by giving instructions. Age verification means checking that a user is old enough to enter, through tools such as a digital ID, a third-party age-check service or other data allowed under the statute.
Utah’s Division of Consumer Protection can impose administrative fines of up to $2,500 per violation, and courts may impose civil penalties of up to $2,500 per violation. A separate 2% excise tax tied to covered transactions starts Oct. 1, not Wednesday.
SB 73, sponsored by Republican state Sen. Calvin Musselman and Republican state Rep. Steve Eliason, was signed by Gov. Spencer Cox on March 19 after passing the House 66-1 and the Senate 22-2. The lopsided votes show Utah lawmakers treated the bill mainly as a child-safety measure.
Privacy groups see a different pressure point. Rindala Alajaji of the Electronic Frontier Foundation wrote that the VPN language creates a “liability trap” and could push websites either to block known VPN addresses or age-check visitors far beyond Utah. Electronic Frontier Foundation
NordVPN, one of the larger consumer VPN providers, said blocking all known VPN and proxy IP addresses in Utah is “technically impossible” because providers keep adding new addresses and no complete blocklist exists. The company called the bill an “unresolvable compliance paradox.” TechRadar
The technical problem is not theoretical. Websites can use IP reputation databases to flag known data-center traffic, but VPN services rotate addresses, some users run private VPNs, and residential endpoints can look like ordinary home connections. Deep packet inspection, a method of examining network traffic in detail, is generally available to network operators, not ordinary websites.
VPN peers are watching. Proton CEO Andy Yen warned in comments cited by TechRadar that age-verification mandates, if adopted broadly, “would mean the death of anonymity online.” Utah’s law gives that concern a narrower, state-level test: whether privacy tools become collateral damage in age-gating rules. TechRadar
But the rollout could still change in court. Aylo Freesites Ltd and Aylo Group Ltd, companies tied to major adult sites, sued Utah officials in federal court on April 22 and filed a motion for a preliminary injunction, the docket showed. If a judge pauses enforcement, the immediate impact could narrow; if not, sites may face a rough choice between stricter age checks, VPN blocks or limiting access from Utah.
The broader legal backdrop favors some age-verification rules. The U.S. Supreme Court in 2025 upheld Texas’ adult-site age-check law in Free Speech Coalition v. Paxton, saying it survived intermediate scrutiny, a legal test for rules that burden speech but do not target it directly. Utah’s next fight is more specific: whether a state can extend that model to VPN workarounds.
